Total
11506 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-59677 | 2026-10-24 | N/A | N/A | ||
| A Missing Authorization vulnerability in selinux policycoreutils seunshares allows a user that is running in unconfined context to kill e.g. root-owned processes running also in unconfined context This issue affects policycoreutils through 3.10. | |||||
| CVE-2026-27423 | 2026-10-24 | N/A | 4.3 MEDIUM | ||
| Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions. | |||||
| CVE-2026-65491 | 2026-10-24 | N/A | 4.3 MEDIUM | ||
| Subscriber Broken Access Control in Query Wrangler <= 1.5.57 versions. | |||||
| CVE-2026-65476 | 2026-10-24 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in Civi <= 2.2.4 versions. | |||||
| CVE-2026-65500 | 2026-10-24 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions. | |||||
| CVE-2026-27422 | 2026-10-24 | N/A | 5.3 MEDIUM | ||
| Missing Authorization vulnerability in bPlugins YT Player yt-player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YT Player: from n/a through 2.1.2. | |||||
| CVE-2026-65433 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions. | |||||
| CVE-2026-57717 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions. | |||||
| CVE-2026-66750 | 2026-10-24 | N/A | 4.3 MEDIUM | ||
| Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room membership checks in the file retrieval route. Attackers can enumerate adjacent MongoDB ObjectIds derived from a known file ID to recover files uploaded by other users, as the GET /files/:id/:name route in app/controllers/files.js only enforces login authentication without consulting room membership or the Room.canJoin check. | |||||
| CVE-2026-59536 | 2026-10-24 | N/A | 7.5 HIGH | ||
| Unauthenticated Broken Access Control in CoCart – Headless ecommerce <= 4.8.4 versions. | |||||
| CVE-2026-25466 | 2026-10-24 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions. | |||||
| CVE-2026-65486 | 2026-10-24 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in Event post <= 6.0.1 versions. | |||||
| CVE-2026-65469 | 2026-10-24 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions. | |||||
| CVE-2026-59557 | 2026-10-24 | N/A | 6.5 MEDIUM | ||
| Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions. | |||||
| CVE-2026-66442 | 2026-10-24 | N/A | 5.4 MEDIUM | ||
| Subscriber Broken Access Control in YayPricing <= 3.5.6 versions. | |||||
| CVE-2026-65568 | 2026-10-24 | N/A | 5.0 MEDIUM | ||
| Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions. | |||||
| CVE-2026-57703 | 2026-10-24 | N/A | 6.3 MEDIUM | ||
| Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions. | |||||
| CVE-2026-65525 | 2026-10-24 | N/A | 5.3 MEDIUM | ||
| Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions. | |||||
| CVE-2026-66012 | 2026-10-24 | N/A | 10.0 CRITICAL | ||
| SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check (model.CheckAuth) with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy actions across the entire workspace. When the Publish server is enabled in anonymous mode (Conf.Publish.Enable=true and Conf.Publish.Auth.Enable=false), the Publish reverse proxy attaches an anonymous RoleReader JWT to proxied requests, allowing a remote unauthenticated attacker to reach /mcp. The attacker can read conf/conf.json to extract accessAuthCode, api.token, and cookieKey in plaintext, write arbitrary files in the workspace, and plant a plugin into data/plugins/ that executes with nodeIntegration:true and no contextIsolation on the next desktop launch, leading to administrator takeover. | |||||
| CVE-2026-7328 | 2026-10-24 | N/A | N/A | ||
| Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AXI addresses. The security impact beyond availability is integration-specific. This issue affects Core Runtime Firmware: 2.1.0. | |||||